mail.escontech.in
Open in
urlscan Pro
173.249.16.196
Malicious Activity!
Public Scan
URL:
https://mail.escontech.in/Access/wells/
Submission: On February 01 via automatic, source openphish — Scanned from DE
Submission: On February 01 via automatic, source openphish — Scanned from DE
Summary
This website contacted 4 IPs
in 2 countries
across 2 domains to perform 14 HTTP transactions.
The main IP is 173.249.16.196, located in
Nuremberg, Germany and
belongs to CONTABO, DE.
The main domain is mail.escontech.in.
TLS certificate: Issued by R3 on January 30th 2022. Valid for: 3 months.
This is the only time mail.escontech.in was scanned on urlscan.io!
TLS certificate: Issued by R3 on January 30th 2022. Valid for: 3 months.
This is the only time mail.escontech.in was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Wells Fargo (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 12 | 173.249.16.196 173.249.16.196 | 51167 (CONTABO) (CONTABO) | |
| 1 | 159.45.2.156 159.45.2.156 | 10837 (WELLSFARG...) (WELLSFARGO-10837) | |
| 1 | 159.45.66.178 159.45.66.178 | 4196 (WELLSFARG...) (WELLSFARGO-4196) | |
| 14 | 4 |
12
173.249.16.196
(Nuremberg, Germany)
ASN51167 (CONTABO, DE)
PTR: vmi784386.contaboserver.net
ASN51167 (CONTABO, DE)
PTR: vmi784386.contaboserver.net
| mail.escontech.in |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 12 |
escontech.in
mail.escontech.in |
803 KB |
| 2 |
wellsfargo.com
connect.secure.wellsfargo.com — Cisco Umbrella Rank: 11354 static.wellsfargo.com — Cisco Umbrella Rank: 11316 |
68 KB |
| 14 | 2 |
| Domain | Requested by | |
|---|---|---|
| 12 | mail.escontech.in |
mail.escontech.in
|
| 1 | static.wellsfargo.com |
mail.escontech.in
|
| 1 | connect.secure.wellsfargo.com |
mail.escontech.in
|
| 14 | 3 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| www.wellsfargo.com |
| oam.wellsfargo.com |
| icomplete.wellsfargo.com |
| www.wellsfargorewards.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| webdisk.escontech.in R3 |
2022-01-30 - 2022-04-30 |
3 months | crt.sh |
| connect.secure.wellsfargo.com DigiCert EV RSA CA G2 |
2020-07-09 - 2022-07-14 |
2 years | crt.sh |
| static.wellsfargo.com DigiCert EV RSA CA G2 |
2020-07-11 - 2022-07-20 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://mail.escontech.in/Access/wells/
Frame ID: 8E1598033134CAA195CFADBFCA4E03AD
Requests: 23 HTTP requests in this frame
Screenshot
Page Title
Sign On to View Your Personal Accounts | Wells FargoPage Statistics
16 Outgoing links
These are links going to different origins than the main page.
URL: https://www.wellsfargo.com/
Search URL Search Domain Scan URL
URL: https://www.wellsfargo.com/help/apply/
Title: Apply
Title: Apply
Search URL Search Domain Scan URL
URL: https://www.wellsfargo.com/locator/
Title: Locations
Title: Locations
Search URL Search Domain Scan URL
URL: https://www.wellsfargo.com/help/
Title: Customer Service
Title: Customer Service
Search URL Search Domain Scan URL
URL: https://www.wellsfargo.com/help/faqs/sign-on
Title: Forgot Password/Username?
Title: Forgot Password/Username?
Search URL Search Domain Scan URL
URL: https://oam.wellsfargo.com/oamo/identity/enrollment
Title: Enroll Now
Title: Enroll Now
Search URL Search Domain Scan URL
URL: https://www.wellsfargo.com/help/faqs/enroll
Title: Enrollment FAQs
Title: Enrollment FAQs
Search URL Search Domain Scan URL
URL: https://www.wellsfargo.com/privacy-security/guarantee
Title: Online Security Guarantee
Title: Online Security Guarantee
Search URL Search Domain Scan URL
URL: https://www.wellsfargo.com/privacy-security/
Title: Privacy, Security and Legal
Title: Privacy, Security and Legal
Search URL Search Domain Scan URL
URL: https://www.wellsfargo.com/online-banking/online-access-agreement/
Title: Online Access Agreement
Title: Online Access Agreement
Search URL Search Domain Scan URL
URL: https://icomplete.wellsfargo.com/oas/status/enter
Title: Applications In Progress
Title: Applications In Progress
Search URL Search Domain Scan URL
URL: https://www.wellsfargorewards.com/
Title: Credit Card Rewards
Title: Credit Card Rewards
Search URL Search Domain Scan URL
URL: https://www.wellsfargo.com/about
Title: About Wells Fargo
Title: About Wells Fargo
Search URL Search Domain Scan URL
URL: https://www.wellsfargo.com/about/careers/
Title: Careers
Title: Careers
Search URL Search Domain Scan URL
URL: https://www.wellsfargo.com/privacy-security/fraud/report/phish
Title: Report Email Fraud
Title: Report Email Fraud
Search URL Search Domain Scan URL
URL: https://www.wellsfargo.com/sitemap
Title: Sitemap
Title: Sitemap
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
14 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
/
mail.escontech.in/Access/wells/ |
410 KB 410 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
a
mail.escontech.in/Access/wells/Sign%20On%20to%20View%20Your%20Personal%20Accounts%20_%20Wells%20Fargo_files/ |
482 B 699 B |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
nd
mail.escontech.in/Access/wells/Sign%20On%20to%20View%20Your%20Personal%20Accounts%20_%20Wells%20Fargo_files/ |
40 KB 40 KB |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
utag.js
mail.escontech.in/Access/wells/Sign%20On%20to%20View%20Your%20Personal%20Accounts%20_%20Wells%20Fargo_files/ |
142 KB 142 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
global.css
mail.escontech.in/Access/wells/Sign%20On%20to%20View%20Your%20Personal%20Accounts%20_%20Wells%20Fargo_files/ |
20 KB 20 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
utag_002.js
mail.escontech.in/Access/wells/Sign%20On%20to%20View%20Your%20Personal%20Accounts%20_%20Wells%20Fargo_files/ |
39 KB 39 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
utag_003.js
mail.escontech.in/Access/wells/Sign%20On%20to%20View%20Your%20Personal%20Accounts%20_%20Wells%20Fargo_files/ |
3 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
login-userprefs.js
mail.escontech.in/Access/wells/Sign%20On%20to%20View%20Your%20Personal%20Accounts%20_%20Wells%20Fargo_files/ |
137 KB 137 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
conutils-6.js
mail.escontech.in/Access/wells/Sign%20On%20to%20View%20Your%20Personal%20Accounts%20_%20Wells%20Fargo_files/ |
10 KB 10 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
atadun.js
mail.escontech.in/Access/wells/Sign%20On%20to%20View%20Your%20Personal%20Accounts%20_%20Wells%20Fargo_files/ |
1 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
12 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
270 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
467 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
889 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
839 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
conutils-6.2.2.js
mail.escontech.in/auth/static/scripts/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
atadun.js
mail.escontech.in/auth/static/prefs/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
nd
connect.secure.wellsfargo.com/jenny/ |
47 KB 17 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
utag.js
static.wellsfargo.com/tracking/main/ |
301 KB 51 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Wells Fargo (Banking)215 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| ndoGetObjectKeys string| ndjsStaticVersion object| nsspuqn object| nsmdmlmdmf boolean| nsmdmlmdm number| nsbbbj number| nslolhyvlo object| nsiodttbi object| nsspuqnp object| nslolh object| nsiodttb object| nsibmekd object| nsbbbjn boolean| nsynq string| nsynqxh object| nds object| nstmsq number| numQueries object| returned string| version undefined| nstmsqui string| nstmsquivx string| nslolhyvl string| nsibm string| nsbbb string| nsspu string| nsspuq object| nsiodttbiw object| nsynqxhvx function| nsspuqnpwj function| nsmdm function| nsbbbjnqw boolean| nsibme object| nsmdml function| nsynqxhv function| nsmdmlm function| ndwti function| ndwts function| nsynqxhvxc function| nslolhyv function| nslolhy function| nsibmekdks function| nsiodtt function| nsbbbjnq function| nstmsqu function| nsbbbjnqwi function| nslol function| nsibmek function| nstmsquiv function| nsynqx function| nstms function| nsibmekdk function| nsiodt function| nsmdmlmd function| nsspuqnpw function| nsiod function| HashUtil function| nsjctnuyx function| nscequr function| nsiojmtr function| nsbdcdsmbc function| nsjct function| nsqquk function| nsiojmtru function| nszxbmhip function| nsiojm function| nsfapzrcj function| nsukygixb function| nsqqukdd function| nsjctn function| nscequrgi function| nszxbmhi object| ndsapi object| antiClickjack string| webId string| ndURI string| USERPREFS_PATH string| UPRESOURCE_PATH string| ATADUN_PATH string| loginUrlBase object| scriptParent function| disableSubmitsCollectUserPrefs function| addLoginFormFieldsAndSubmit function| jsEnabled function| addEvent object| UserPrefsHelper object| collector function| loadUserPrefs function| submitUserPrefs function| getUserPrefsOnPageLoad function| undoSaveUsername function| maskedUsernameChanged function| addScriptElement boolean| m object| q object| options object| lun3 boolean| isNative object| js object| fjs object| LoginForm object| Search function| updateCustomSelect object| utag_data boolean| utag_condload string| new_path object| utag_cfg_ovrd object| userAgentArr object| utag function| utag_pad function| utag_visitor_id undefined| linkCanonical object| pagesToOptimize object| dmtElems undefined| pathname undefined| urlArray undefined| url undefined| sRegExInput undefined| customDMPEvent undefined| getPayload undefined| fireDMPEvent function| isNotUndefinedOrNull function| getDocumentTitleLabel function| sendDataToGA function| closest function| previous_sibling function| getMtgApplyURL function| getMtgApplyAppInviteURL function| getMtgURL function| getMtgRatesURL function| getMtgRatesCalculatorURL function| getMtgRefinancURL function| getMtgFirstTimeHomeBuyerURL function| getMtgResultsURL function| getEquityURL function| getMtgCompareLoansURL function| getMtgComfortZoneURL boolean| __tealium_twc_switch string| gtagRename object| dataLayer function| gtag function| nszhmnyl boolean| nsbfxmyizd function| nsqepb function| nsfpgi object| nszhmnyli object| nsgefuvnz function| nsjcmfmsb boolean| nsawpee number| nsqep number| nsvcfjpsrx object| nsawp object| nsawpe object| nsbfxmyi function| nsqepbqtpk function| nsqepbqtp function| nsbfxmy function| nsjcmf object| nsqepbqt function| nsfpgiza function| nsgefuvnzi object| nsjcmfm object| nsgef boolean| nsqepbq function| nsgefuv string| nsgefuvn string| nsjcm function| nsjcmfmsbv function| nsvcfj function| nsbfx function| nsvcfjp string| nsfpgizawr function| nsfpgizaw string| nsjcmfms function| nszhmny function| nsawpeewsf function| nsbfxm string| nsawpeews function| nsbfxmyiz string| nszhm string| nsfpg string| nsvcfjpsr string| nsfpgiz function| nshscln object| nsawpeew object| nsgefu function| nsvcf function| nseqhktar function| nsvcfjps function| nszhmn function| nsyvcg function| validateSessionIdCookie function| nslvdiqr function| nsxxfbeiiw function| nsoygz function| nsoygzvik function| nsymuiu function| nshsc function| nslvd function| nsjwksia function| nseqhkt function| nsjwksianl function| nshsclnd function| nseqhktars function| nslvdiqrtj function| nsxxf function| nsjwksian function| nslvdiqrt function| nseqh function| nsyvcgpnmr function| nsxxfb function| nsjwk function| nsoygzv object| nszhmnylil function| nsyvc2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| .escontech.in/ | Name: utag_main Value: v_id:017eb2e2d9aa005cbf11c646866803072002706a00b08$_sn:1$_ss:1$_st:1643680518379$ses_id:1643678718379%3Bexp-session$_pn:1%3Bexp-session |
|
| .escontech.in/ | Name: ndsid Value: ndsafehv6ji8xv4kz3fvd0h |
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
connect.secure.wellsfargo.com
mail.escontech.in
static.wellsfargo.com
159.45.2.156
159.45.66.178
173.249.16.196
037d71c699303b123f95a8c914479511db22b9f9262f19e51fc17385aff0323d
17f3818bba16137fba7657230309043ae41cd08a5df25a7c61cd9583291c1354
198506f95f9c0cf3a670f82ea63f9a560bd6ff9a17c153ad4ac5d8777e0fda21
1ed889a15705bc76729d29d715c64f3d7f35de2ea519e1d2704924cf40d9e30d
24fd3582bdb3259bf3bee75926b108e0cf19a3a5bd1ed486922c932290c8458c
2910f07eb1efbf99cb485fe848fd1aaa251bcd9c6cb3276426492daa45651be3
353bf977917e8144dad0cc66d728d4fb3ae8a7469de505b4c118ce3e13fdc453
5145f5faf6c1269bdd974357ed344b9cd5f4e4cea424c14dd302a9c11a206741
524334591f0a303f83bca01c7c38da4147eb139c098aeff6fe0e393cca06630c
5a545d96913facedca3359858f22a4f6e89dbe23dafcda91f4914a4c246d0343
705bd8e4384ec9aa56df0603e0763aca2ce9a427c15d36fee5d97622b318c535
7b276e5173282620545b51350123f747ceeaca0f1d67137d65694074ddabccff
9f78dc4ae74a2df5da09c77293c685f0176fc46123a661f0b8b543186dccbeb0
ab78c44d5e86c6f0937d203066ebcadbf50c8d63407564a151bdd03701f40a70
b319b049366dde73690990738ac5af4fb9937d18abac85b01aaff185b5262868
b99dead0deb91299630edd2fdc72855aac3836ea262473d47348e218a7744264
df500743bbedcef7623fdf2ef0c05ca411437c6216674271f4cc8b32f910f96d
ea6617fd72b6224d7a0972213f6ae4dac55a6c05a3d553c603942e5c2b275678
f7899cfdbc342decc4aeb0bae9ada39bfaa8ae3c687fc72119fca2efdf77dff2
f809fa596dc2e66029e195d0aef2d6d7b077ea1f7d145455441ba893875aec41
fa2abc92232cf2379399a23775d042edcb77c358644eb938722a14d17ec4db31